Russian agents used Facebook to influence the 2017 election. Congress missed the chance to delve into what the company's CEO Mark Zuckerberg knows about it—and how he'll stop it in 2018. OVER THE LAST two days, Facebook CEO Mark Zuckerberg was questioned for more than 10 hours by two different Congressional committees. There was granular focus on privacy definitions and data collection, and quick footwork by Zuckerberg—backed by a phalanx of lawyers, consultants, and coaches—to craft a narrative that users “control” their data. (They don’t.) But the gaping hole at the center of both hearings was the virtual absence of questions on the tactics and purpose of Russian information operations conducted against Americans on Facebook during the 2016 elections.
Here are the five of the biggest questions about Russia that Zuckerberg wasn’t asked or didn’t answer—and why it’s important for Facebook to provide clear information on these issues.
1. What were the tools and tactics used by Russian entities to execute information operations against American citizens, and what were the narratives pursued?
In both hearings, in answering unrelated questions, Zuckerberg began to describe “large networks of fake accounts" established by Russian entities. In both instances, he was cut off. This was a significant missed opportunity to pull back the curtain on the mechanisms of Russian information operations against the American public.
The vast majority of information made available by Facebook—and the focus of questions in response—have been about ads and promoted content from Russian entities like the Internet Research Agency. In fact, this was not the primary means of distributing content, collecting information, identifying potential supporters, and promoting narratives. The main tool for this was fake accounts posting "native" content—plain old Facebook posts—building relationships with real users.
In Wednesday’s hearing before the House Energy & Commerce Committee, for example, Zuckerberg said that tens of thousands of fake accounts were taken down to prevent interference in elections in 2017, implying that this was mostly relating to Russia. But this wholesale removal of accounts obviously went way beyond the 740 accounts that have been identified as buying ads on behalf of the IRA. Zuckerberg focused only on ads bought by Russian accounts, not the regular Facebook posts that were so much more numerous. He testified that the Russian accounts were primarily using “issues ads”—aimed at influencing people’s views on issues rather than promoting specific candidates or political messaging. Asked about the content though, Zuckerberg said he had no specific knowledge.
In the indictment of the IRA, prosecutors highlighted the fact that the agency had used false IDs to verify false personas. So, while Facebook's announcement that group pages will now require verification with a government ID and a physical address that can be validated, fake IDs and the use of US-registered shell corporations (a point raised by Senator Sheldon Whitehouse) can be used to bypass these security protocols—albeit with a much more significant expenditure of resources.
Zuckerberg said Facebook only identified Russian information operations being conducted on their platform right before the 2016 elections. But in his written testimony, he says they saw and addressed activity relating to Russian intelligence agencies earlier. And from 2014 onward, Facebook was made aware of the aggressive information campaigns being run against Ukraine by Russia.
It wasn't an accident that Zuckerberg used the term "sophisticated adversaries" in his prepared statement. Facebook, more than anyone, has visibility into what Russia does and why it works. Apparently, no one was interested in hearing what he had to say.
2. What personal data does Facebook make available to the Russian state media monitoring agency Roskomnadzor or other Russian agencies? Is this only from accounts located in or operated from Russia, or does this include Facebook's global data?
These questions were asked by former fighter pilot and Russia-hawk Rep. Adam Kinzinger—and answered evasively by Zuckerberg, who did not address the fact that the Russian government requires companies like Facebook to store their data in Russia precisely so they can access it (and that the Russians say that Facebook has agreed to comply). Very few companies—including Twitter and YouTube—have provided much transparency on what data they share with the Russian government. This is important because, depending on the scale, Russia doesn't need to rely on data harvesters if they can just get it themselves. In another instance, a corporate partnership was formed with Uber to force data sharing.
This is also important because Zuckerberg expressed extreme skepticism about sharing data with the US government. Does he feel the same way about foreign entities? When law enforcement or intelligence agencies from more aggressive foreign governments ask for information, does Facebook comply? Is there any instance where they have complied with a foreign government request that they would deny the United States?
In both hearings, Zuckerberg was also asked if Russia or China scrape Facebook data, or used apps like the one used by Aleksandr Kogan, the data scientist who provided Facebook data to Cambridge Analytica. Zuckerberg responded that he didn’t have specific knowledge of that—but, as Rep. Jan Schakowsky pointed out, there were 9 million apps scraping data, so how can they possibly begin to know where the data and all its derivative copies went?
Zuckerberg called Chinese internet companies a “strategic and technological threat”—and whoever asked the question just moved on. This is a huge admission from one of the people best positioned to understand how AI and data tech can be weaponized by adversaries. Next time, maybe let the man talk about what he sees and the threats we are up against?
3. Did Facebook delete data related to Russian information operations conducted against American citizens? Will it agree to make this material available for researchers?
In the House hearing, there was one question relating to data preservation in connection to the Cambridge Analytica case. But not a single member asked if Facebook has preserved all of the data and content connected to Russian information operations conducted against American citizens, or whether that data and content would be made available to researchers or intelligence agencies for evaluation.
Many accounts have been pulled down and deleted, and while some of the advertising clients have been exposed, many of the fake accounts and false identities are not known to the public. It is vital that this information be analyzed by people who understand what the Russians were trying to achieve so we can evaluate how to limit computational propaganda from hostile entities and assess the impact these operations had on our population. Without this kind of analysis, we will never unravel the damage or build realistic defenses against these capabilities.
Zuckerberg got no questions about mitigating the psychological impact of these operations. There were no questions to about Facebook’s own internal research and evaluation of these tools and tactics. And no one asked what Facebook knows about their broader effectiveness or impact on the public.
4. What assistance do Facebook employees embedded with advertising clients provide? Did any Facebook employees provide support to the Internet Research Agency or any other business or agency in Russia targeting content to American citizens?
Facebook dodged a major bullet because this entire line of questioning was left unexplored. There was one question about Facebook employees embedded in 2016 political campaigns; largely Zuckerberg answered sideways. But there are extremely important questions to be raised about the way in which Facebook employees aided and enabled harvesters of data and the targeting of hostile information operations—not only against the American public, but in other countries as well.
If Facebook employees worked with the Russians to define more effective audience targeting, for example, then they had vastly more knowledge than they admit and are vastly more complicit. The same would be true if Facebook embeds were working with third parties like Cambridge Analytica and other companies that help governments and ruling parties target their oppositions and win elections. For example, Cambridge Analytica/SCL’s work in Africa shows how aggressively Facebook was used in elections. Did Facebook know? Were they involved? Do their employees have direct knowledge of or aid “black PR” and coercive psychological operations?
5. Does Facebook have copies of data uploaded to "custom audiences" by any Russian entity?
In many ways, the data will be the fingerprints of the investigations of the Russian operations in the 2016 elections. As part of Facebook's “custom audiences” feature, you can upload datasets to target Facebook users. If there is overlapping targeting data or instances in which similar data was used by different advertising clients, you can show potential coordination between separate entities—for example, maybe the IRA and the NRA, or the dark money PACs running ads against Clinton. Does Facebook have any known Russian datasets from 2016 that could be compared to Cambridge Analytica and or Trump campaign data?
Senator Amy Klobuchar highlighted the fact that 126 million people saw IRA content and asked if these people overlapped with the 87 million who had their data scraped by Cambridge. Zuckerberg said it was “entirely possible” that they overlapped. If this can be documented, it would make it likely that the Cambridge Analytica data was used by the Russians and by the Trump campaign—and this would mean coordination between the two entities. The question then would be who knew about the shared data?
AMERICAN PRIVACY IS important. But gaining a more expansive understanding of the information operations being targeted against our population by hostile foreign actors like Russia is also critical. In that respect, the Zuckerberg hearings were a huge missed opportunity. We do not have a lot of time to assess and evaluate what happened in 2016 before the 2018 elections are upon us. This is not merely a cybersecurity challenge; it’s not just about protecting voting machines or email servers. There is an information component that is not being addressed, and doing so gets harder when companies like Facebook are erasing and suppressing the data that can help us become more informed and help us develop a new kind of human-led deterrence that will prevent these campaigns from being as effective in the future.
Zuckerberg repeatedly referred to the idea of data “control” that was completely nonsensical to anybody who actually speaks English as a first language. We don't control our data. Especially not when Facebook is aggressively harvesting data on everyone, not just their 2 billion users, and building internet access globally so they can get even more data. It doesn’t matter that Facebook isn’t “selling data”—an oft-repeated theme. They are using psychographics to profile you and selling advertisers access to the products of those algorithms. This is why there was evasion on questions about predictive profiling—the entire backend of adtech. Facebook knows it works. They use it every day—and they understand exactly how effective it can be for hostile actors like Russia.
Mr. Zuck Goes to Washington
Congress asked Mark Zuckerberg simple questions, because no one really understands how Facebook works
During his two days of testimony, Mark Zuckerberg repeatedly misrepresented how much control users really have over their privacy
Molly K. McKew (@MollyMcKew) is an expert on information warfare and the narrative architect at New Media Frontier. She advised Georgian President from 2009-2013 and former Moldovan Prime Minister Vlad Filat in 2014-15.
No comments:
Post a Comment